hullproof 0.0.0-stage → 0.5.0

package/dist/map/expo.js

@@ -0,0 +1,190 @@
+import { testCodeReason } from '../report/test-code.js';
+import { empty, makeEntry, normPath } from './entry.js';
+import { splitArgs } from './lex.js';
+import { exportedFunctions, resolveFunction } from './js-next.js';
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
+const SOURCE_EXT = /\.[cm]?[jt]sx?$/;
+// Session reads in mobile code: auth hooks and contexts, provider SDK calls, secure storage of a token.
+const EXPO_SESSION = [
+    { re: /\b(?:useAuth|isSignedIn|useSession|useUser|useAuthContext|useAuthState|useSupabaseSession|useConvexAuth|useKindeAuth|useAuth0)\b/, via: 'auth hook', conf: 'medium' },
+    { re: /\bsupabase\.auth\.(?:getSession|getUser|onAuthStateChange)\b|\bonAuthStateChanged\s*\(|\bgetAuth\s*\(|\bfirebase\.auth\(\)|\bauth\(\)\.currentUser|\bClerkProvider\b|\bSignedIn\b|\bSignedOut\b/, via: 'auth provider', conf: 'high' },
+    { re: /\b(?:SecureStore|AsyncStorage|storage)\.(?:getItem|getItemAsync|get|getString)\s*\(\s*['"][\w.-]*(?:token|session|jwt|auth)[\w.-]*['"]/i, via: 'stored token', conf: 'medium' },
+    { re: /\b(?:isAuthenticated|isLoggedIn|isAuthed|signedIn|loggedIn)\b/, via: 'signed in flag', conf: 'medium' },
+];
+const GUARD_REDIRECT = /<Redirect\b[^>]*\bhref\b|\brouter\.(?:replace|push|navigate)\s*\(|\bnavigation\.(?:replace|navigate|reset)\s*\(|\bProtected\b[^>]*\bguard\s*=|\bredirect\s*\(/;
+const GUARD_CONDITION = /\bif\s*\(\s*!\s*\(?\s*\w*(?:session|user|token|signedIn|isSignedIn|isAuthenticated|isLoggedIn|authenticated|auth)\w*|\bguard\s*=\s*\{|[?&]{2}\s*<Redirect|:\s*<Redirect/i;
+// The status compared with a string, as in if (status === 'signOut'): the string is blank in the masked copy, so this reads the text.
+const GUARD_STATUS = /\bif\s*\([^)]*['"](?:signOut|signedOut|unauthenticated|loggedOut|logged_out|anonymous|guest)['"]/i;
+const PUBLIC_GROUP = /\((?:auth|public|login|sign-?in|sign-?up|onboarding|welcome|landing|guest|unauth\w*)\)/i;
+function roots(repo) {
+    const out = [];
+    for (const f of repo.ctx.files) {
+        if (!/(?:^|\/)package\.json$/.test(f) || /node_modules\//.test(f))
+            continue;
+        if (/"expo-router"|"expo"\s*:/.test(repo.ctx.text(f)))
+            out.push(f.replace(/package\.json$/, ''));
+    }
+    return out.sort();
+}
+const routePath = (rel) => {
+    const segs = rel.replace(SOURCE_EXT, '').split('/').filter((s) => s && !/^\(.*\)$/.test(s) && !s.startsWith('@'));
+    if (segs[segs.length - 1] === 'index')
+        segs.pop();
+    return normPath('/' + segs.join('/').replace(/\[\.\.\.(\w+)\]/g, '*$1').replace(/\[(\w+)\]/g, ':$1'));
+};
+function layoutGuard(v) {
+    const session = EXPO_SESSION.some((s) => s.re.test(v.masked));
+    const redirect = GUARD_REDIRECT.exec(v.masked);
+    if (!session || !redirect)
+        return null;
+    const cond = GUARD_CONDITION.test(v.masked) || GUARD_STATUS.test(v.text);
+    if (!cond && !/\bProtected\b/.test(v.masked))
+        return null;
+    return { line: v.lines.at(redirect.index), enforced: cond ? true : null };
+}
+export function extractExpo(repo) {
+    const out = empty();
+    for (const root of roots(repo)) {
+        const appDir = [`${root}app/`, `${root}src/app/`].find((d) => repo.ctx.files.some((f) => f.startsWith(d)));
+        const files = repo.ctx.files.filter((f) => f.startsWith(root) && !/node_modules\//.test(f) && SOURCE_EXT.test(f) && !/\.d\.ts$/.test(f));
+        if (appDir) {
+            // Layout guards, by directory.
+            const guards = [];
+            for (const f of files) {
+                if (!f.startsWith(appDir) || !/(?:^|\/)_layout\.[cm]?[jt]sx?$/.test(f))
+                    continue;
+                const v = repo.view(f);
+                const g = v ? layoutGuard(v) : null;
+                if (v && g)
+                    guards.push({ dir: f.slice(0, f.lastIndexOf('/') + 1), file: f, fact: g, text: v.masked });
+            }
+            for (const f of files) {
+                if (!f.startsWith(appDir))
+                    continue;
+                const rel = f.slice(appDir.length);
+                const base = rel.split('/').pop();
+                if (/^_layout\./.test(base) || /^\+(?:html|not-found|native-intent)\./.test(base))
+                    continue;
+                const v = repo.view(f);
+                if (!v)
+                    continue;
+                if (/\+api\.[cm]?[jt]sx?$/.test(f)) {
+                    const path = routePath(rel.replace(/\+api(\.[cm]?[jt]sx?)$/, '$1'));
+                    for (const e of exportedFunctions(repo, v)) {
+                        if (!METHODS.includes(e.exportName))
+                            continue;
+                        const r = e.r;
+                        const seeds = [...(r.params.length ? r.params : ['request', 'req']), 'params'];
+                        out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'expo-api', file: f, line: e.line, method: e.exportName, path, name: e.exportName, confidence: 'high', handlerView: r.view, spec: { start: r.start, end: r.end, seeds, decorators: r.wrapper ? [{ view: v, start: r.wrapper.from, end: r.wrapper.to, scope: 'wrapper' }] : [], extraCalls: r.wrapper ? [r.wrapper.name] : [], returnsJson: true } }));
+                    }
+                    continue;
+                }
+                // A screen: the file under app/ with a default export that is not a layout.
+                const DEFAULT_EXPORT = /\bexport\s+default\b|\bexport\s*\{[^}]*(?:\bas\s+default|\bdefault\b)[^}]*\}/;
+                if (!DEFAULT_EXPORT.test(v.masked))
+                    continue;
+                const path = routePath(rel);
+                const seeds = ['params', 'searchParams'];
+                for (const m of v.masked.matchAll(/\b(?:const|let)\s+(\{[^}]*\}|\w+)\s*=\s*use(?:Local|Global)?SearchParams\b/g))
+                    seeds.push(...[...m[1].matchAll(/\w+/g)].map((x) => x[0]));
+                const dm = /\bexport\s+default\s+(?:async\s+)?function\s+(\w+)/.exec(v.masked);
+                const ep = makeEntry(repo, { kind: 'page', framework: 'expo-router', file: f, line: v.lines.at(dm?.index ?? Math.max(0, v.masked.search(DEFAULT_EXPORT))), method: null, path, name: dm?.[1] ?? null, confidence: 'high', handlerView: v, spec: { start: 0, end: v.text.length, seeds, returnsJson: false }, tags: ['mobile_screen'] });
+                const extra = [];
+                for (const s of EXPO_SESSION) {
+                    const m = s.re.exec(v.masked);
+                    if (m) {
+                        extra.push({ kind: 'session_read', scope: 'handler', file: f, line: v.lines.at(m.index), via: s.via, enforced: null, confidence: s.conf === 'high' ? 'medium' : 'medium' });
+                        break;
+                    }
+                }
+                const publicGroup = PUBLIC_GROUP.test(f.slice(appDir.length));
+                for (const g of guards) {
+                    if (!f.startsWith(g.dir) || publicGroup)
+                        continue;
+                    extra.push({ kind: 'session_read', scope: 'router', file: g.file, line: g.fact.line, via: 'expo layout guard (client side)', enforced: g.fact.enforced, confidence: 'medium' });
+                }
+                if (extra.length) {
+                    ep.protections = [...ep.protections, ...extra].sort((a, b) => a.line - b.line || (a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : 0) || (a.via < b.via ? -1 : 1));
+                    if (guards.some((g) => f.startsWith(g.dir)) && !publicGroup)
+                        ep.tags = [...new Set([...ep.tags, 'guarded'])].sort();
+                }
+                if (publicGroup)
+                    ep.tags = [...new Set([...ep.tags, 'public'])].sort();
+                out.entries.push(ep);
+            }
+        }
+        // Deep links declared in the app config.
+        for (const cfg of [`${root}app.json`, `${root}app.config.json`]) {
+            const text = repo.ctx.text(cfg);
+            if (!text)
+                continue;
+            let json = null;
+            try {
+                json = JSON.parse(text);
+            }
+            catch {
+                json = null;
+            }
+            const expo = (json?.expo ?? json ?? {});
+            const lineOf = (needle) => { const i = text.indexOf(needle); return i < 0 ? 1 : text.slice(0, i).split('\n').length; };
+            const add = (path, name, needle, tags) => {
+                const line = lineOf(needle);
+                out.entries.push(deepLink(cfg, line, path, name, 'high', tags));
+            };
+            const scheme = expo.scheme;
+            for (const s of Array.isArray(scheme) ? scheme : scheme ? [scheme] : [])
+                if (typeof s === 'string')
+                    add(`${s}://`, 'custom scheme', `"${s}"`, ['deep_link', 'custom_scheme']);
+            const ios = (expo.ios ?? {});
+            for (const d of Array.isArray(ios.associatedDomains) ? ios.associatedDomains : [])
+                if (typeof d === 'string' && d.startsWith('applinks:'))
+                    add(`https://${d.slice(9)}/`, 'universal link', `"${d}"`, ['deep_link', 'universal_link']);
+            const android = (expo.android ?? {});
+            for (const f of android.intentFilters ?? [])
+                for (const d of f.data ?? [])
+                    if (d.scheme)
+                        add(`${d.scheme}://${d.host ?? ''}${d.pathPrefix ?? ''}`, f.autoVerify ? 'android app link' : 'android intent filter', `"${d.host ?? d.scheme}"`, ['deep_link', ...(f.autoVerify ? ['universal_link'] : ['custom_scheme'])]);
+        }
+        for (const cfg of [`${root}app.config.js`, `${root}app.config.ts`]) {
+            const text = repo.ctx.text(cfg);
+            if (!text)
+                continue;
+            for (const m of text.matchAll(/\bscheme\s*:\s*['"]([\w+.-]+)['"]/g))
+                out.entries.push(deepLink(cfg, text.slice(0, m.index).split('\n').length, `${m[1]}://`, 'custom scheme', 'high', ['deep_link', 'custom_scheme']));
+        }
+        // Deep links handled in code.
+        for (const f of files) {
+            const v = repo.view(f);
+            if (!v || !/\bLinking\b|\buseURL\b|\bprefixes\s*:/.test(v.masked))
+                continue;
+            for (const x of v.masked.matchAll(/\bLinking\.addEventListener\s*\(/g)) {
+                const open = x.index + x[0].length - 1;
+                const args = splitArgs(v.masked, open);
+                if (args.length < 2 || !/^['"]url['"]$/.test(v.text.slice(args[0].start, args[0].end).trim()))
+                    continue;
+                const r = resolveFunction(repo, v, args[1].start, args[1].end);
+                const spec = r ? { start: r.start, end: r.end, seeds: r.params.length ? r.params : ['event', 'url'], returnsJson: false } : { start: x.index, end: args[args.length - 1].end, seeds: ['event', 'url'], returnsJson: false };
+                out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'react-native', file: f, line: v.lines.at(x.index), method: null, path: null, name: 'Linking url listener', confidence: r ? 'high' : 'medium', handlerView: r?.view ?? v, spec, tags: ['deep_link'] }));
+            }
+            for (const x of v.masked.matchAll(/\b(?:Linking\.getInitialURL|useURL)\s*\(/g)) {
+                const at = x.index;
+                const line = v.lines.at(at);
+                const end = Math.min(v.text.length, v.lines.start(line + 12));
+                out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'react-native', file: f, line, method: null, path: null, name: x[0].replace(/\s*\($/, ''), confidence: 'medium', handlerView: v, spec: { start: at, end, seeds: ['url', 'initialUrl', 'event'], returnsJson: false }, tags: ['deep_link'] }));
+            }
+            for (const x of v.masked.matchAll(/\bprefixes\s*:\s*\[/g)) {
+                const line = v.lines.at(x.index);
+                const prefixes = [...v.text.slice(x.index, x.index + 300).matchAll(/['"]([^'"]+:\/\/[^'"]*)['"]/g)].map((y) => y[1]);
+                const end = Math.min(v.text.length, v.lines.start(line + 25));
+                out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'react-navigation', file: f, line, method: null, path: prefixes[0] ?? null, name: 'navigation linking config', confidence: 'medium', handlerView: v, spec: { start: x.index, end, seeds: [], returnsJson: false }, tags: ['deep_link'] }));
+            }
+        }
+    }
+    return out;
+}
+function deepLink(file, line, path, name, confidence, tags) {
+    return {
+        id: `${file}:${line}:deep_link:-:${path}:${name}`, kind: 'deep_link', framework: 'expo', file, line, end_line: line, method: null, path, name, handler: null, confidence,
+        test_code: testCodeReason(file) !== null, tags: [...tags].sort(), protections: [], reads: [{ source: 'params', line }], data: [], outbound: [],
+    };
+}

package/dist/map/go.js

@@ -0,0 +1,292 @@
+import { empty, joinPath, makeEntry } from './entry.js';
+import { goFunc } from './light-index.js';
+import { analyzeLight } from './light.js';
+import { closeOf, splitArgs } from './lex.js';
+const ROUTER_TYPE = /\*?(?:gin\.(?:Engine|RouterGroup|IRouter|IRoutes)|chi\.(?:Router|Mux)|echo\.(?:Echo|Group)|fiber\.(?:App|Router)|mux\.Router|http\.ServeMux)\b/;
+const FW_BY_IMPORT = [[/gin-gonic\/gin/, 'gin'], [/go-chi\/chi/, 'chi'], [/labstack\/echo/, 'echo'], [/gofiber\/fiber/, 'fiber'], [/gorilla\/mux/, 'gorilla-mux']];
+const METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'CONNECT', 'TRACE']);
+const CREATE = /(?<![\w.])([A-Za-z_]\w*)\s*(?::=|=)\s*(?:chi\.NewRouter|chi\.NewMux|gin\.Default|gin\.New|echo\.New|fiber\.New|mux\.NewRouter|http\.NewServeMux|NewRouter|NewServeMux)\s*\(/g;
+const ROUTE_CALLS = new Set(['Get', 'Post', 'Put', 'Patch', 'Delete', 'Head', 'Options', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'Any', 'All', 'Handle', 'HandleFunc', 'Method', 'MethodFunc', 'Match', 'Add', 'Connect', 'Trace', 'Mount', 'Use', 'Group', 'Route', 'With', 'PathPrefix', 'Subrouter', 'Static']);
+const unq = (s) => /^\s*(?:"((?:\\.|[^"\\])*)"|`([^`]*)`)\s*$/.exec(s)?.slice(1).find((x) => x !== undefined) ?? null;
+export function goFiles(repo) {
+    return repo.filesOf('go').filter((f) => { const v = repo.view(f); return !!v && /net\/http|gin-gonic|go-chi|labstack\/echo|gofiber|gorilla\/mux/.test(v.imports); });
+}
+export function extractGoAll(repo, fn, local) {
+    const out = empty();
+    const keyOf = (f) => `${f.file}#${f.start}`;
+    const funcs = [];
+    for (const file of goFiles(repo)) {
+        const v = repo.view(file);
+        for (const x of v.masked.matchAll(/^func\s+(?:\(\s*\w*\s*\*?\s*[\w.[\]]+\s*\)\s*)?(\w+)\s*[([]/gm)) {
+            const f = goFunc(v.masked, x.index);
+            if (f)
+                funcs.push({ file, view: v, start: f.start, end: f.end, bodyStart: f.bodyStart, params: f.params, name: x[1] });
+        }
+        // Package level routing, outside any function: var mux = http.NewServeMux(); func init() is a function and is covered above.
+    }
+    const scanned = new Map();
+    const mounted = new Map();
+    const scan = (f, base) => {
+        const r = scanFunction(repo, fn, local, f, base);
+        return r;
+    };
+    for (const f of funcs)
+        scanned.set(keyOf(f), scan(f, null));
+    // Mounted routers: scan the function that builds them again at the mount prefix, and drop its standalone result.
+    const queue = [...scanned.values()].flatMap((s) => s.mounts);
+    for (let depth = 0; depth < 4 && queue.length; depth++) {
+        const next = [];
+        for (const m of queue.splice(0)) {
+            for (const name of m.targets) {
+                const t = fn.defs(name).filter((d) => d.view.lang === 'go' && funcs.some((f) => f.file === d.view.file && f.start === d.start))[0];
+                if (!t)
+                    continue;
+                const ref = funcs.find((f) => f.file === t.view.file && f.start === t.start);
+                const key = keyOf(ref);
+                if (mounted.has(key))
+                    continue;
+                const env = { prefix: m.prefix, mws: m.mws, fw: m.fw, param: true };
+                mounted.set(key, env);
+                const res = scan(ref, env);
+                scanned.set(key, res);
+                next.push(...res.mounts);
+            }
+        }
+        queue.push(...next);
+    }
+    for (const [, s] of [...scanned.entries()].sort(([a], [b]) => (a < b ? -1 : 1)))
+        out.entries.push(...s.entries);
+    return out;
+}
+function scanFunction(repo, fn, local, f, base) {
+    const v = f.view;
+    const fw0 = FW_BY_IMPORT.find(([re]) => re.test(v.imports))?.[1] ?? 'net-http';
+    const entries = [];
+    const mounts = [];
+    const env = new Map();
+    let baseUsed = false;
+    const fresh = () => { if (base && !baseUsed) {
+        baseUsed = true;
+        return { ...base, mws: base.mws.slice() };
+    } return { prefix: '', mws: [], fw: fw0, param: false }; };
+    // Routers handed in as parameters.
+    for (const part of f.params.split(',')) {
+        const m = /^\s*(\w+)\s+(.+)$/.exec(part);
+        if (m && ROUTER_TYPE.test(m[2]))
+            env.set(m[1], base ? { ...base, mws: base.mws.slice() } : { prefix: '', mws: [], fw: fw0, param: true });
+    }
+    if (base && env.size)
+        baseUsed = true;
+    if (/"net\/http"/.test(v.imports))
+        env.set('http', { prefix: '', mws: [], fw: 'net-http', param: false });
+    const text = v.text;
+    const masked = v.masked;
+    const mwOf = (a, scope, only = null) => ({ view: v, start: a.start, end: a.end, scope, only });
+    const route = (e, recv, method, open, chained, at, forced) => {
+        const args = splitArgs(masked, open);
+        if (!args.length)
+            return;
+        let verb = forced;
+        let pathIdx = 0;
+        if (method === 'Handle' && args.length >= 3 && unq(text.slice(args[0].start, args[0].end)) && METHODS.has(unq(text.slice(args[0].start, args[0].end)))) {
+            verb = unq(text.slice(args[0].start, args[0].end));
+            pathIdx = 1;
+        }
+        if (method === 'Add' && args.length >= 3) {
+            verb = unq(text.slice(args[0].start, args[0].end));
+            pathIdx = 1;
+        }
+        if ((method === 'Method' || method === 'MethodFunc') && args.length >= 3) {
+            verb = unq(text.slice(args[0].start, args[0].end))?.toUpperCase() ?? null;
+            pathIdx = 1;
+        }
+        if (method === 'Match' && args.length >= 3) {
+            verb = 'ANY';
+            pathIdx = 1;
+        }
+        if (!verb)
+            verb = ROUTE_CALLS.has(method) && METHODS.has(method.toUpperCase()) ? method.toUpperCase() : 'ANY';
+        let path = unq(text.slice(args[pathIdx].start, args[pathIdx].end));
+        if (path === null)
+            return;
+        // Go 1.22 patterns: "GET /notes/{id}", and gorilla/chi style braces.
+        const pm = /^([A-Z]+)\s+(\S.*)$/.exec(path);
+        if (pm && METHODS.has(pm[1])) {
+            verb = pm[1];
+            path = pm[2];
+        }
+        path = path.replace(/\{(\w+)(?::[^}]*)?\}/g, ':$1').replace(/:(\w+)(?=\/|$)/g, ':$1').replace(/\*(\w*)/g, (_m, n) => `*${n || 'rest'}`).replace(/\{(\w+)\.\.\.\}/g, '*$1');
+        const rest = args.slice(pathIdx + 1);
+        if (!rest.length)
+            return;
+        const echo = e.fw === 'echo';
+        const handlerArg = echo ? rest[0] : rest[rest.length - 1];
+        const perRoute = (echo ? rest.slice(1) : rest.slice(0, -1)).map((a) => mwOf(a, 'wrapper'));
+        const full = joinPath(e.prefix, path);
+        const handlerText = text.slice(handlerArg.start, handlerArg.end);
+        if (/\bFileServer\b|\bStripPrefix\b|\bStatic\b/.test(handlerText) && !/func\s*\(/.test(handlerText))
+            return;
+        const resolved = resolveHandler(repo, fn, v, handlerArg);
+        const decorators = [
+            ...e.mws.filter((m) => m.only === null || full.startsWith(m.only)).map((m) => ({ view: m.view, start: m.start, end: m.end, scope: m.scope })),
+            ...chained.map((m) => ({ view: m.view, start: m.start, end: m.end, scope: m.scope })),
+            ...perRoute.map((m) => ({ view: m.view, start: m.start, end: m.end, scope: m.scope })),
+            ...resolved.wrappers.map((w) => ({ view: v, start: w.start, end: w.end, scope: 'wrapper' })),
+        ];
+        const hv = resolved.view;
+        const a = analyzeLight(hv, { start: resolved.start, end: resolved.end, seeds: [], decorators, lookup: fn.find, local });
+        const line = v.lines.at(at);
+        entries.push(makeEntry(repo, {
+            kind: 'http_route', framework: e.fw, file: v.file, line, method: verb, path: full, name: resolved.name,
+            confidence: e.param || !resolved.found ? 'medium' : 'high', handlerView: hv, spec: { start: resolved.start, end: resolved.end, seeds: [] }, analysis: a,
+        }));
+    };
+    const evs = [];
+    const body = [f.bodyStart, f.end];
+    CREATE.lastIndex = 0;
+    for (const m of masked.slice(body[0], body[1]).matchAll(CREATE))
+        evs.push({ at: body[0] + m.index, kind: 'create', m: m });
+    const callRe = /(?<![\w.])([A-Za-z_]\w*)\s*\.\s*([A-Za-z_]\w*)\s*\(/g;
+    for (const m of masked.slice(body[0], body[1]).matchAll(callRe))
+        evs.push({ at: body[0] + m.index, kind: 'call', m: m });
+    evs.sort((a, b) => a.at - b.at || (a.kind === 'create' ? -1 : 1));
+    let skipTo = -1;
+    const handleCall = (recv, method, at, open, e, assignTo, within) => {
+        const args = splitArgs(masked, open);
+        const closeAt = closeOf(masked, open);
+        if (method === 'Use') {
+            let only = null;
+            let list = args;
+            if (e.fw === 'fiber' && args.length > 1 && unq(text.slice(args[0].start, args[0].end)) !== null) {
+                only = unq(text.slice(args[0].start, args[0].end));
+                list = args.slice(1);
+            }
+            for (const a of list)
+                e.mws.push(mwOf(a, 'router', only === null ? null : joinPath(e.prefix, only)));
+            return closeAt;
+        }
+        if ((method === 'Group' || method === 'Route') && args.length) {
+            // chi: r.Route("/p", func(r chi.Router) { ... }) and r.Group(func(r chi.Router) { ... })
+            const lit = args.find((a) => /^func\s*\(/.test(masked.slice(a.start, a.end)));
+            if (lit && /\bchi\b|Router/.test(masked.slice(lit.start, lit.start + 80))) {
+                const g = goFunc(masked, lit.start);
+                const pm = /^func\s*\(\s*(\w+)/.exec(masked.slice(lit.start));
+                if (g && pm) {
+                    const p = method === 'Route' ? unq(text.slice(args[0].start, args[0].end)) ?? '' : '';
+                    const child = { prefix: joinPath(e.prefix, p || '/'), mws: e.mws.slice(), fw: e.fw, param: e.param };
+                    const inner = new Map(within);
+                    inner.set(pm[1], child);
+                    walkRange(g.bodyStart + 1, g.end - 1, inner);
+                    return g.end;
+                }
+            }
+            if (assignTo) {
+                const p = unq(text.slice(args[0].start, args[0].end)) ?? '';
+                const child = { prefix: joinPath(e.prefix, p || '/'), mws: [...e.mws, ...args.slice(1).map((a) => mwOf(a, 'router'))], fw: e.fw, param: e.param };
+                within.set(assignTo, child);
+                return closeAt;
+            }
+            return closeAt;
+        }
+        if (method === 'PathPrefix' && assignTo) {
+            const p = unq(text.slice(args[0]?.start ?? 0, args[0]?.end ?? 0)) ?? '';
+            within.set(assignTo, { prefix: joinPath(e.prefix, p || '/'), mws: e.mws.slice(), fw: e.fw, param: e.param });
+            return closeAt;
+        }
+        if (method === 'With') {
+            const tail = /^\s*\.\s*([A-Za-z_]\w*)\s*\(/.exec(masked.slice(closeAt, closeAt + 60));
+            if (tail) {
+                const chained = args.map((a) => mwOf(a, 'wrapper'));
+                const open2 = closeAt + tail[0].length - 1;
+                route(e, recv, tail[1], open2, chained, at, null);
+                return closeOf(masked, open2);
+            }
+            return closeAt;
+        }
+        if (method === 'Mount') {
+            const p = unq(text.slice(args[0]?.start ?? 0, args[0]?.end ?? 0));
+            const target = args[1] ? text.slice(args[1].start, args[1].end) : '';
+            if (p !== null) {
+                const names = [...target.matchAll(/(?<![\w.])(\w+)\s*\(/g)].map((x) => x[1]).concat(/^\s*\w+\s*$/.test(target) ? [target.trim()] : []);
+                mounts.push({ prefix: joinPath(e.prefix, p), mws: e.mws.slice(), fw: e.fw, targets: names, from: v.file });
+            }
+            return closeAt;
+        }
+        if (method === 'Subrouter' || method === 'Static')
+            return closeAt;
+        if (ROUTE_CALLS.has(method) || METHODS.has(method.toUpperCase())) {
+            // gorilla/mux: r.HandleFunc("/x", h).Methods("POST")
+            let forced = null;
+            const meth = /^\s*\.\s*Methods\s*\(([^)]*)\)/.exec(masked.slice(closeAt, closeAt + 80));
+            if (meth)
+                forced = [...text.slice(closeAt, closeAt + 120).matchAll(/"(\w+)"/g)].map((x) => x[1].toUpperCase())[0] ?? null;
+            route(e, recv, method, open, [], at, forced);
+            return meth ? closeAt + meth[0].length : closeAt;
+        }
+        return closeAt;
+    };
+    const walkRange = (from, to, scope) => {
+        for (const ev of evs) {
+            if (ev.at < from || ev.at >= to || ev.at < skipTo)
+                continue;
+            if (ev.kind === 'create') {
+                scope.set(ev.m[1], fresh());
+                continue;
+            }
+            const recv = ev.m[1];
+            const method = ev.m[2];
+            const e = scope.get(recv);
+            if (!e)
+                continue;
+            const open = ev.at + ev.m[0].length - 1;
+            const pre = masked.slice(Math.max(0, ev.at - 80), ev.at);
+            const assign = /(?:^|\n)\s*(\w+)\s*:?=\s*$/.exec(pre)?.[1] ?? null;
+            const end = handleCall(recv, method, ev.at, open, e, assign, scope);
+            if (end > skipTo)
+                skipTo = end;
+        }
+    };
+    walkRange(body[0], body[1], env);
+    return { entries, mounts };
+}
+// A handler argument: a function literal, a name, a method value (h.CreateNote), or a call that wraps or builds a handler.
+function resolveHandler(repo, fn, v, a, depth = 0) {
+    const m = v.masked;
+    const t = m.slice(a.start, a.end).trim();
+    const miss = { view: v, start: a.start, end: a.end, name: /^(?:\w+\.)*(\w+)$/.exec(t)?.[1] ?? null, found: false, wrappers: [] };
+    if (depth > 4)
+        return miss;
+    if (/^func\s*\(/.test(t)) {
+        const g = goFunc(m, a.start + (m.slice(a.start, a.end).length - m.slice(a.start, a.end).trimStart().length));
+        if (g)
+            return { view: v, start: g.start, end: g.end, name: null, found: true, wrappers: [] };
+    }
+    const call = /^((?:\w+\.)*\w+)\s*\(/.exec(t);
+    if (call) {
+        const at = a.start + (m.slice(a.start, a.end).length - m.slice(a.start, a.end).trimStart().length);
+        const open = at + call[0].length - 1;
+        const args = splitArgs(m, open);
+        const head = call[1];
+        const last = head.split('.').pop();
+        if (/^HandlerFunc$/.test(last) && args.length === 1)
+            return resolveHandler(repo, fn, v, args[0], depth + 1);
+        for (const x of args) {
+            const r = resolveHandler(repo, fn, v, x, depth + 1);
+            if (r.found)
+                return { ...r, wrappers: [{ start: at, end: x.start }, ...r.wrappers] };
+        }
+        // A handler factory: s.handleCreate() returns the handler, so read its body.
+        const def = fn.find(last, v.file) ?? fn.defs(last)[0];
+        if (def)
+            return { view: def.view, start: def.start, end: def.end, name: last, found: true, wrappers: [] };
+        return miss;
+    }
+    const nm = /^(?:\w+\.)*(\w+)$/.exec(t)?.[1];
+    if (nm) {
+        const defs = fn.defs(nm);
+        const def = fn.find(nm, v.file) ?? defs.find((d) => d.view.file === v.file) ?? defs[0];
+        if (def)
+            return { view: def.view, start: def.start, end: def.end, name: nm, found: true, wrappers: [] };
+    }
+    return miss;
+}

package/dist/map/js-express.js

@@ -0,0 +1,143 @@
+import { analyze } from './analyze.js';
+import { empty, joinPath, makeEntry } from './entry.js';
+import { closeOf, jsFunction, splitArgs } from './lex.js';
+import { paramsOf, resolveFunction } from './js-next.js';
+const FRAMEWORK = /\b(?:express|fastify|koa|hono|restify|polka|@hapi\/hapi|itty-router|elysia|@koa\/router|koa-router|connect|h3|@fastify\/\w+)\b/;
+const CREATORS = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*(?:await\s+)?(?:new\s+)?(?:express\s*\.\s*Router|express|Router|fastify|Fastify|Hono|Koa|Elysia|polka|createRouter|KoaRouter|restify\s*\.\s*createServer|\w*[rR]outer)\s*[(<]/g;
+const VERBS = new Set(['get', 'post', 'put', 'patch', 'delete', 'all', 'options', 'head']);
+const confMin = (cs) => (cs.includes('low') ? 'low' : cs.includes('medium') ? 'medium' : 'high');
+function literalPaths(v, a) {
+    if (!a)
+        return null;
+    const c = v.masked[a.start];
+    if (c === '"' || c === "'" || c === '`') {
+        const p = v.text.slice(a.start + 1, a.end - 1);
+        return p.startsWith('/') || p === '*' || p === '' ? [p] : null;
+    }
+    if (c === '[') {
+        const ps = [...v.text.slice(a.start, a.end).matchAll(/['"`]([^'"`]*)['"`]/g)].map((x) => x[1]).filter((p) => p.startsWith('/') || p === '*');
+        return ps.length ? ps : null;
+    }
+    return null;
+}
+export function extractExpress(repo, v) {
+    const out = empty();
+    if (!FRAMEWORK.test(v.imports) && !/\bexpress\s*\(\s*\)|\bRouter\s*\(\s*\)/.test(v.masked))
+        return out;
+    const names = new Set(['app', 'router', 'server', 'api', 'route', 'routes', 'fastify', 'instance']);
+    for (const m of v.masked.matchAll(CREATORS))
+        names.add(m[1]);
+    const recv = [...names].map((n) => n.replace(/\$/g, '\\$')).join('|');
+    const call = new RegExp(`(?<![.\\w$])(?:${recv})\\s*\\.\\s*(get|post|put|patch|delete|all|options|head|use|route)\\s*\\(`, 'g');
+    const imports = repo.importMap(v);
+    const helpers = repo.helpers('js');
+    const middlewareDeco = (args) => args.map((a) => ({ view: v, start: a.start, end: a.end, scope: 'wrapper' }));
+    const calledNames = (args) => {
+        const set = new Set();
+        for (const a of args)
+            for (const m of v.masked.slice(a.start, a.end).matchAll(/(?<![\w$])([A-Za-z_$][\w$]*)\s*(?:\(|,|$)/g))
+                set.add(m[1]);
+        for (const a of args) {
+            const t = v.masked.slice(a.start, a.end);
+            const id = /^[A-Za-z_$][\w$.]*$/.exec(t);
+            if (id)
+                set.add(id[0].split('.').pop());
+        }
+        return [...set].sort();
+    };
+    const register = (verb, paths, args, at) => {
+        if (!args.length)
+            return;
+        const last = args[args.length - 1];
+        const mws = args.slice(0, -1);
+        const r = resolveFunction(repo, v, last.start, last.end);
+        const line = v.lines.at(at);
+        for (const p of paths) {
+            const method = verb === 'all' ? 'ANY' : verb.toUpperCase();
+            const handlerView = r?.view ?? v;
+            const start = r?.start ?? last.start;
+            const end = r?.end ?? last.end;
+            const seeds = r ? (r.params.length ? [r.params[0]] : ['req']) : [];
+            const deco = middlewareDeco(mws);
+            if (r?.wrapper)
+                deco.push({ view: v, start: r.wrapper.from, end: r.wrapper.to, scope: 'wrapper' });
+            const extra = calledNames(mws).concat(r?.wrapper ? [r.wrapper.name.split('.').pop()] : []);
+            const e = makeEntry(repo, {
+                kind: 'http_route', framework: 'express', file: v.file, line, method, path: joinPath('', p === '' ? '/' : p), name: r?.defName ?? nameOf(v, last),
+                confidence: 'high', handlerView, spec: { start, end, seeds, decorators: deco, extraCalls: extra, returnsJson: true },
+            });
+            out.entries.push(e);
+        }
+    };
+    for (const m of v.masked.matchAll(call)) {
+        const verb = m[1];
+        const open = m.index + m[0].length - 1;
+        const args = splitArgs(v.masked, open);
+        if (verb === 'route') {
+            const paths = literalPaths(v, args[0]);
+            if (!paths)
+                continue;
+            // .route('/x').get(h).post(h): read the chain after the call.
+            let i = closeOf(v.masked, open);
+            if (i < 0)
+                continue;
+            for (let g = 0; g < 8; g++) {
+                const nxt = /^\s*\.\s*(get|post|put|patch|delete|all|options|head)\s*\(/.exec(v.masked.slice(i, i + 60));
+                if (!nxt)
+                    break;
+                const o = i + nxt[0].length - 1;
+                register(nxt[1], paths, splitArgs(v.masked, o), i + nxt[0].indexOf(nxt[1]));
+                i = closeOf(v.masked, o);
+                if (i < 0)
+                    break;
+            }
+            continue;
+        }
+        if (VERBS.has(verb)) {
+            const paths = literalPaths(v, args[0]);
+            if (!paths || args.length < 2)
+                continue;
+            register(verb, paths, args.slice(1), m.index);
+            continue;
+        }
+        // use(): a gate on a path, or a router mount.
+        const paths = literalPaths(v, args[0]);
+        const rest = paths ? args.slice(1) : args;
+        const prefix = paths?.[0] ?? '*';
+        const line = v.lines.at(m.index);
+        let target = null;
+        for (const a of rest) {
+            const id = /^[A-Za-z_$][\w$]*$/.exec(v.masked.slice(a.start, a.end));
+            const spec = id ? imports.get(id[0]) : undefined;
+            const file = spec ? repo.resolveImport(v.file, spec) : null;
+            if (file && /\bRouter\s*\(|\bexpress\.Router\b|\bnew\s+Hono\b|\bfastify\b/.test(repo.ctx.text(file)))
+                target = file;
+        }
+        const gateArgs = rest.filter((a) => { const id = /^[A-Za-z_$][\w$]*$/.exec(v.masked.slice(a.start, a.end)); return !(id && target && imports.get(id[0]) && repo.resolveImport(v.file, imports.get(id[0])) === target); });
+        const protections = [];
+        for (const a of gateArgs) {
+            const spec = { start: a.start, end: a.end, seeds: [], decorators: [], extraCalls: calledNames([a]), returnsJson: false, gate: true };
+            const an = analyze(v, spec, helpers);
+            for (const p of an.protections)
+                if (p.kind !== 'owner_filter' && p.kind !== 'audit_log')
+                    protections.push({ ...p, scope: 'middleware' });
+        }
+        const joined = protections.length ? protections : [];
+        if (target)
+            out.mounts.push({ from: v.file, line, prefix: joinPath('', prefix === '*' ? '/' : prefix), target, protections: joined });
+        else if (joined.length) {
+            const gate = { id: `${v.file}:${line}:use:${prefix}`, kind: 'middleware', framework: 'express', file: v.file, line, paths: [prefix === '*' ? '*' : joinPath('', prefix)], methods: [], protections: joined, confidence: confMin(joined.map((p) => p.confidence)) === 'high' ? 'medium' : confMin(joined.map((p) => p.confidence)) };
+            out.gates.push(gate);
+        }
+    }
+    return out;
+}
+// A readable name for the handler argument: the function name, or the called factory, or null for an inline function.
+function nameOf(v, a) {
+    const t = v.masked.slice(a.start, a.end);
+    if (/^(?:async\b|function\b|\(|[A-Za-z_$][\w$]*\s*=>)/.test(t))
+        return null;
+    const m = /^([A-Za-z_$][\w$.]*)/.exec(t);
+    return m ? m[1] : null;
+}
+export { paramsOf };